CVE-2020-5274 — Information Exposure via Error Message in Symfony

CWE-209 — Information Exposure via Error Message8 documents6 sources

Severity

5.4MEDIUMNVD

CNA4.6

EPSS

0.3%

top 49.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Symfony Sensiolabs Symfony Symfony Error-handler

Timeline

PublishedMar 30

Latest updateApr 3

Description

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages5 packages

▶Packagistsymfony/symfony4.4.0 — 4.4.4+1

▶NVDsensiolabs/symfony4.4.0 — 4.4.4+1

▶Packagistsymfony/error-handler4.4.0 — 4.4.4+1

▶Debiansymfony/symfony< 4.4.8-1+3

▶CVEListV5symfony/symfony>= 4.0.0, < 4.4.5, >= 5.0.0, < 5.0.5+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

CVE-2020-5274: In Symfony before versions 5↗2020-03-30

▶

CVEList

Exceptions displayed in non-debug configurations in Symfony↗2020-03-30

▶

OSV

Exceptions displayed in non-debug configurations in Symfony↗2020-03-30

▶

GHSA

Exceptions displayed in non-debug configurations in Symfony↗2020-03-30

▶

📋Vendor Advisories

Debian

CVE-2020-5274: symfony - In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception wer...↗2020

▶

💬Community

Bugzilla

CVE-2020-5274 php-symfony4: symfony: ErrorHandler displays stacktraces in non-debug environments which could result in Information Disclosure [fedora-all]↗2020-04-03

▶

Bugzilla

CVE-2020-5274 symfony: ErrorHandler displays stacktraces in non-debug environments which could result in Information Disclosure↗2020-04-03

▶